{"id":"SPM-003","section":"AI Security Posture Management","requirement":"Detect endpoint AI activity beyond the browser","acceptance":"Identify desktop clients, IDEs, coding assistants, CLI tools and local agents on managed Windows and macOS endpoints.","tier":"AT0, AT1","whyItMatters":"Desktop apps, IDEs and CLI tools carry a growing share of AI use, and browser-only controls never see them.","verificationMethod":"LT","verificationTest":"Desktop assistants, coding tools and CLI tools used by pilot users appear, attributed to user, device and application.","formerly":"DIS-003","alsoIn":[],"sort":2,"adoptionContext":"Endpoint inspection complements browser visibility for shadow applications and code-executing agent activity on employee devices.","mappings":[{"frameworks":["csf","iso27001"],"explanation":"Finding desktop, IDE, CLI and local-agent activity fills software-discovery and monitoring gaps beyond browsers. These observations must feed maintained, owned inventory records and analysis; identification alone establishes neither.","kind":"framework","references":{"csf":["ID.AM-02","DE.CM-03","DE.CM-09"],"iso27001":["A.5.9","A.8.16"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Visibility into AI clients and processes on managed endpoints contributes to in-life operation monitoring, subject to demonstrated Windows and macOS coverage.","kind":"framework","references":{"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"Endpoint findings supply control information and monitoring inputs for otherwise hidden AI use. Client identification alone does not demonstrate suspicious-activity analysis.","kind":"framework","references":{"soc2":["CC2.1","CC7.2"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-003","frameworkRefs":{"ISO27001":["A.5.9","A.8.16"],"ISO42001":["A.6.2.6"],"NIST-CSF":["ID.AM-02","DE.CM-03","DE.CM-09"],"SOC2":["CC2.1","CC7.2"]}}